Skip to content

Commit c2781c4

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add 2 reports
 - data/reports/GO-2024-2958.yaml - data/reports/GO-2024-2959.yaml Fixes #2958 Fixes #2959 Change-Id: Ieb3702f7cb60ccd4ad960d7768d75a12b5f6e414 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/596000 Reviewed-by: Tim King <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Tatiana Bradley <[email protected]>
1 parent d5af20e commit c2781c4

File tree

4 files changed

+198
-0
lines changed

4 files changed

+198
-0
lines changed

‎data/osv/GO-2024-2958.json

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2958",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-37298",
8+
"GHSA-3669-72x9-r9p3"
9+
],
10+
"summary": "Potential memory exhaustion attack due to sparse slice deserialization in github.com/gorilla/schema",
11+
"details": "Potential memory exhaustion attack due to sparse slice deserialization in github.com/gorilla/schema",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/gorilla/schema",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.4.1"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/gorilla/schema",
35+
"symbols": [
36+
"Decoder.Decode",
37+
"Decoder.decode",
38+
"NewDecoder"
39+
]
40+
}
41+
]
42+
}
43+
}
44+
],
45+
"references": [
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://github.com/gorilla/schema/security/advisories/GHSA-3669-72x9-r9p3"
49+
},
50+
{
51+
"type": "FIX",
52+
"url": "https://github.com/gorilla/schema/commit/cd59f2f12cbdfa9c06aa63e425d1fe4a806967ff"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://github.com/gorilla/schema/blob/main/decoder.go#L223"
57+
}
58+
],
59+
"credits": [
60+
{
61+
"name": "@AlexVasiluta"
62+
}
63+
],
64+
"database_specific": {
65+
"url": "https://pkg.go.dev/vuln/GO-2024-2958",
66+
"review_status": "REVIEWED"
67+
}
68+
}

‎data/osv/GO-2024-2959.json

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2959",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-38513",
8+
"GHSA-98j2-3j3p-fw2v"
9+
],
10+
"summary": "Session Middleware Token Injection Vulnerability in github.com/gofiber/fiber",
11+
"details": "Session Middleware Token Injection Vulnerability in github.com/gofiber/fiber",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/gofiber/fiber",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/gofiber/fiber/v2",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
},
42+
{
43+
"fixed": "2.52.5"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {
49+
"imports": [
50+
{
51+
"path": "github.com/gofiber/fiber/v2/middleware/session",
52+
"symbols": [
53+
"Store.Get",
54+
"Store.responseCookies"
55+
]
56+
}
57+
]
58+
}
59+
}
60+
],
61+
"references": [
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://github.com/gofiber/fiber/security/advisories/GHSA-98j2-3j3p-fw2v"
65+
},
66+
{
67+
"type": "FIX",
68+
"url": "https://github.com/gofiber/fiber/commit/7926e5bf4da03e54f62d27d53229d35b264cba8e"
69+
}
70+
],
71+
"database_specific": {
72+
"url": "https://pkg.go.dev/vuln/GO-2024-2959",
73+
"review_status": "REVIEWED"
74+
}
75+
}

‎data/reports/GO-2024-2958.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
id: GO-2024-2958
2+
modules:
3+
- module: github.com/gorilla/schema
4+
versions:
5+
- fixed: 1.4.1
6+
vulnerable_at: 1.4.0
7+
packages:
8+
- package: github.com/gorilla/schema
9+
symbols:
10+
- NewDecoder
11+
- Decoder.decode
12+
derived_symbols:
13+
- Decoder.Decode
14+
summary: Potential memory exhaustion attack due to sparse slice deserialization in github.com/gorilla/schema
15+
cves:
16+
- CVE-2024-37298
17+
ghsas:
18+
- GHSA-3669-72x9-r9p3
19+
unknown_aliases:
20+
- CGA-qch5-pg6h-qrrg
21+
credits:
22+
- '@AlexVasiluta'
23+
references:
24+
- advisory: https://github.com/gorilla/schema/security/advisories/GHSA-3669-72x9-r9p3
25+
- fix: https://github.com/gorilla/schema/commit/cd59f2f12cbdfa9c06aa63e425d1fe4a806967ff
26+
- web: https://github.com/gorilla/schema/blob/main/decoder.go#L223
27+
source:
28+
id: GHSA-3669-72x9-r9p3
29+
created: 2024-07-02T11:03:24.924951-04:00
30+
review_status: REVIEWED

‎data/reports/GO-2024-2959.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: GO-2024-2959
2+
modules:
3+
- module: github.com/gofiber/fiber
4+
vulnerable_at: 1.14.6
5+
- module: github.com/gofiber/fiber/v2
6+
versions:
7+
- fixed: 2.52.5
8+
vulnerable_at: 2.52.4
9+
packages:
10+
- package: github.com/gofiber/fiber/v2/middleware/session
11+
symbols:
12+
- Store.Get
13+
- Store.responseCookies
14+
summary: Session Middleware Token Injection Vulnerability in github.com/gofiber/fiber
15+
cves:
16+
- CVE-2024-38513
17+
ghsas:
18+
- GHSA-98j2-3j3p-fw2v
19+
references:
20+
- advisory: https://github.com/gofiber/fiber/security/advisories/GHSA-98j2-3j3p-fw2v
21+
- fix: https://github.com/gofiber/fiber/commit/7926e5bf4da03e54f62d27d53229d35b264cba8e
22+
source:
23+
id: GHSA-98j2-3j3p-fw2v
24+
created: 2024-07-02T11:03:15.390979-04:00
25+
review_status: REVIEWED

0 commit comments

Comments
 (0)